Arbor

Code context for people and agents.

Find a function’s callers. Trace the path through your code.

Know what breaks before you break it.

arbor retirements finds direct OpenAI, Anthropic and Google SDK calls in Python code that use a retired or retiring model, and says what has to change.

OpenAI shuts down the dated gpt-4o and gpt-4.1 snapshots on 14 January 2027. Shutdown list

Simulated replay — the arbor commands and their output are real (tokio @ 178k LOC). Methodology: BENCHMARKS.md

v3.1.1 · A fix release. The arbor retirements data was read again on 28 October 2026 and now lists the bare gpt-5 and o3, which OpenAI's deprecations page gives 11 December 2026. npx @anandb71/arbor-cli runs on npm 12, and Arbor no longer takes your home folder as the project because ~/.arbor exists. Release notes

---

Why Arbor

Most AI coding tools treat code as text. Arbor builds a semantic dependency graph — functions, classes, and modules as nodes; calls, imports, and inheritance as edges — then answers execution-aware questions with deterministic precision:

No keyword guessing. No embedding hallucinations. One graph, every interface.

Where the graph is *unsure*, it says so — edges carry a confidence, and ambiguous resolutions are labelled rather than hidden. An honest unknown beats a confident wrong answer.

---

What's new in v3.1.1

A fix release. No breaking changes; as after every upgrade, a saved graph is rebuilt once on first use.

When the terminal report of arbor retirements lists a call to a retired or retiring model, it now ends with an offer of a paid readiness review. The link carries three values from the run: how many calls are listed, how many are already retired and the next shutdown date. Arbor sends nothing. The offer is not printed with --json, --markdown, --annotations or --quiet, or when the CI environment variable is set (GitHub Actions sets it), and the GitHub Action does not show it. Release notes

v3.1.0 ( arbor retirements and arbor usages )

Two commands for Python code that calls AI model APIs. Both run locally, with no account, API key or telemetry.

Python only for now. Release notes

v3.0.3 (Rust calls through paths and macros, per-symbol diff, --base )

A fix release. Every item below was a wrong answer, not a missing feature, and each ships with a regression test.

Also new: arbor receipt. After each coding-agent turn it explains, in plain English, what changed and what was touched that you didn't ask for, with arbor receipt undo to put a turn back.

Cached graphs from 3.0.0 are rebuilt automatically on first use.

v3.0.0 — The Right Node (symbol resolution consults the importing file)

One fix, measured.

Symbol resolution consults the importing file. When a bare name matched definitions in several modules, resolve_ref fell through to SameDir and attached the edge to whichever definition sat in the caller's own directory — not a dropped edge, a confidently misrouted one, stamped at 0.55 confidence.

GraphBuilder already kept a per-file import map, but only apply_import_validation read it, and that scores an edge *after* one has been chosen. It never saw the references going to the wrong node. Consulting it between the same-file and same-directory checks keeps a local definition shadowing an import, while letting a written import beat mere adjacency. Resolution::ViaImport scores 0.93, above SameDir's 0.55.

Measured

A fixture of 260 modules across 10 layers, each layer defining the same 26 function names. Ground truth is derived from the generator's own edge list, so the expected answer is exact rather than estimated.

Previously flat at about 22 regardless of the real answer. Now it tracks. Risk on the largest hub moves from LOW to CRITICAL.

Total edge count barely moves (1335 → 1334). That is the signature of misrouting rather than loss: the edges were always there, pointing at the wrong nodes.

Breaking

• Resolution gains a ViaImport variant — an exha